When most people look at a PDA, they see a harmless device that is handy for keeping a few notes, or maybe playing solitaire. What they don't realize is that this seemingly innocuously device is vulnerable to many of the same standard security threats that its big brother, the PC, faces on a routine basis. As a result, these little computers are often passed over as a security risk, which is good news for those with malicious intent.

This talk will start with a short overview on reverse-engineering Pocket PC (Windows Mobile) binaries, followed by several examples that sequeway into demonstrations of a live Pocket PC backdoor/Trojan and a nasty little buffer overflow attack. From here we examine airborne viruses and finish with several examples/demonstrations of how a PDA can be useful as a malicious hacker's tool.

Seth Fogie is the VP of Dallas-based Airscanner Corporation where he oversees the development of security software for the Window Mobile (POcket PC) platform. Seth recently earned his Masters Degree in Information Technology, and has worked in several IT related fields, from IT Manager to ISP support specialist. He has co-authored four technical books on information security, including the top selling "Maximum Wireless Security" from SAMS, and the recently released "Security Warrior" from O'Reilly. Mr. Fogie frequently speaks at IT and security conferences, including Defcon (10 & 11), CSI, and Dallascon. In addition, Seth has co-authored the HIPAA medical education course for the Texas Medical Associate and is acting Site Host for Security at Pearson Education's "InformIT.com" website where he writes articles and reviews/manages weekly information security related books and articles.

While commonly entrenched within bleeding-edge technology, most forget the importance and art of management and getting the very best out of your personnel investment – a.k.a. your largest and most valuable corporate asset. This talk aims to address the eight critical focal points that all information security managers must recognize and take action upon to ensure the ongoing success for their team. Building from the lessons learned and implemented while at Harvard, Wharton, Guardent, Foundstone, and now CSC, Foster will overview the “Top 8” principles for building and managing world-class information security teams.

James C. Foster (CISSP, CCSE), Deputy Director, Global Security Development for CSC, is responsible for the technical vision and development of security solutions within CSC. Prior to joining CSC, Foster was the Director of R&D for Foundstone Inc. and responsible for all aspects of product and corporate R&D initiatives. Foster was also a Senior Advisor and Research Scientist with Guardent Inc.(Acquired by Verisign) and an adjunct author at Information Security Magazine(Acquired by TechTarget.) Foster has co-authored or contributed to books including Snort 2.0, Snort 2.1, Hacking Exposed 4th Ed, Special Ops Security, Intrusion Detection and Prevention, Anti-Hacker Toolkit 2nd Ed, Hacking the Code, and Anti-Spam Toolkit. Foster has an AS, BS, MBA and is currently a fellow at the University of Pennsylvania's Wharton School of Business.

There are a plethora of antivirus software tests available—magazines, universities, and  commercial organizations abound with reports of antivirus software performance. However, you need to know what these tests actually measure in order to evaluate and interpret the test—and that may be more complicated than it sounds! For example, tests that show “100% detection” may not tell you that it took the product 4 tries to get there, or that the things its detecting aren’t even viruses; some testers may create or modify viruses for testing, creating a test that looks and sounds sexy and inviting—but that does not measure what users are likely to encounter. This faced-paced presentation examines the current state of affairs in antivirus software testing and takes a look at the strengths and weaknesses of available tests so that you can more critically evaluate the tests that help you make decisions about protecting your corporation’s data..

Sarah Gordon is a Senior Research Fellow at Symantec Security Response. Her current research areas include testing and standards for antivirus and security software, privacy issues, cyberterrorism and psychological aspects of human/computer interaction. She has been featured in diverse publications such as IEEE Monitor, The Wall Street Journal and Time Digital, and profiled by PBS, ITN, and CNN International. A highly sought-after speaker, Sarah has presented at conferences ranging from DEFCON to Govsec. She serves on the Editorial Board for Elsevier Science Computers and Security Journal, and is Senior Editor of Network Security Magazine. She also serves on the Advisory Board of Virus Bulletin, and is a both co-founder and board member of The WildList Organization International. She is just completing a four-year term as Technical Director of The European Institute for Computer Antivirus Research, where she also serves on the organization's conference committee.

Responsible for security testing and recommendation for The United Nations, Sarah participates in various initiatives for Homeland Security and Infrastructure Protection. She was chosen to represent the security industry in "Facts on File: Careers for Kids who Like Adventure"; her work in ethics, technology and profiling computer criminals is required coursework in various academic information security programs. She is committed to excellence in information security education, guest lecturing at Universities world-wide on topics ranging from virus writers and hackers to the truth about cyberterrorism.

Sarah's undergraduate work focused on special projects in both UNIX system security and ethical issues in technology. She holds a Master's Degree in Professional Counseling/Human Behavior. Prior to joining Symantec, she worked with the Massively Distributed Systems Group at IBM's Thomas J. Watson Research Laboratory in New York in the AntiVirus Research and Development Team. She lives with her husband Richard in Florida, where she enjoys singing, songwriting, swimming, shelties and sunsets.

We’ve heard the saying “Do As I Say, Not as I Do”—and it applies now to information security! People say they value privacy—defined herein as the control of disclosure of information about themselves and/or their transactions. This is true almost universally, even when they differ on their definition of control or what is ‘private” data. However, despite this valuation, you may be shocked to learn that many people—specifically information security professionals—do not conform to functional behaviours that reinforce this control, putting valuable information of all types at risk. The study upon which this presentation is based showed that information security professional in the US, UK and EU often fail to take advantage of technical and policy solutions that could help mitigate risks to their corporation. It is a wake up call for corporations worldwide, and challenges the attendee to examine his or her own behaviour in light of his corporate security culture.

Sarah Gordon is a Senior Research Fellow at Symantec Security Response. Her current research areas include testing and standards for antivirus and security software, privacy issues, cyberterrorism and psychological aspects of human/computer interaction. She has been featured in diverse publications such as IEEE Monitor, The Wall Street Journal and Time Digital, and profiled by PBS, ITN, and CNN International. A highly sought-after speaker, Sarah has presented at conferences ranging from DEFCON to Govsec. She serves on the Editorial Board for Elsevier Science Computers and Security Journal, and is Senior Editor of Network Security Magazine. She also serves on the Advisory Board of Virus Bulletin, and is a both co-founder and board member of The WildList Organization International. She is just completing a four-year term as Technical Director of The European Institute for Computer Antivirus Research, where she also serves on the organization's conference committee..

Responsible for security testing and recommendation for The United Nations, Sarah participates in various initiatives for Homeland Security and Infrastructure Protection. She was chosen to represent the security industry in "Facts on File: Careers for Kids who Like Adventure"; her work in ethics, technology and profiling computer criminals is required coursework in various academic information security programs. She is committed to excellence in information security education, guest lecturing at Universities world-wide on topics ranging from virus writers and hackers to the truth about cyberterrorism.

Sarah's undergraduate work focused on special projects in both UNIX system security and ethical issues in technology. She holds a Master's Degree in Professional Counseling/Human Behavior, and a PhD in Computer Science. Prior to joining Symantec, she worked with the Massively Distributed Systems Group at IBM's Thomas J. Watson Research Laboratory in New York in the AntiVirus Research and Development Team. She lives with her husband Richard in Florida, where she enjoys singing, songwriting, swimming, shelties and sunsets.

This talk examines the details behind successful hardware attacks of early authentication tokens: Two USB devices and one iButton device. We'll be looking at the methods used to compromise the devices and gain access to private data stored on them without having legitimate credentials. Our attacks were based on an approach of using only common, off-the-shelf tools, yet we still succeeded in defeating the security features. While learning from history is important to avoid repeating the same design mistakes, we'll also look at some of the newer authentication tokens and hypothesize about potential attacks.

Joe Grand is the President and CEO of Grand Idea Studio, a product development and intellectual property licensing firm.

A nationally recognized name in computer security, Joe's pioneering research on mobile devices, digital forensics, and embedded security analysis is published in various industry journals. He is the author of "Hardware Hacking: Have Fun While Voiding Your Warranty", a co-author of "Stealing The Network: How to Own A Continent", and is a frequent contributor to other texts. As an electrical engineer, Joe specializes in the invention and design of breakthrough concepts and technologies. Many of his creations including consumer electronics, medical products, video games, and toys are licensed worldwide.

Joe has testified before the United States Senate Governmental Affairs Committee and is a former member of the legendary hacker collective L0pht Heavy Industries. He has presented his work at numerous academic, industry, and private forums, including the United States Air Force Office of Special Investigations and the IBM Thomas J. Watson Research Center. Joe holds a BSCE from Boston University.

The design of secure hardware is often overlooked in the product development lifecycle, leaving many devices vulnerable to hacker attacks resulting in theft of service, loss of revenue, or a damaged reputation. Many times, products must be redesigned after a harmful incident, which raises overall development costs and increases time-to-market. This paper focuses on general concepts for secure hardware design coupled with practical examples. Topics in this talk include recommendations on incorporating security into the product development cycle, attack and threat models, and design solutions for enclosure, circuit board, and firmware layers.

Joe Grand is the President and CEO of Grand Idea Studio, a product development and intellectual property licensing firm.

A nationally recognized name in computer security, Joe's pioneering research on mobile devices, digital forensics, and embedded security analysis is published in various industry journals. He is the author of "Hardware Hacking: Have Fun While Voiding Your Warranty", a co-author of "Stealing The Network: How to Own A Continent", and is a frequent contributor to other texts. As an electrical engineer, Joe specializes in the invention and design of breakthrough concepts and technologies. Many of his creations including consumer electronics, medical products, video games, and toys are licensed worldwide.

Joe has testified before the United States Senate Governmental Affairs Committee and is a former member of the legendary hacker collective L0pht Heavy Industries. He has presented his work at numerous academic, industry, and private forums, including the United States Air Force Office of Special Investigations and the IBM Thomas J. Watson Research Center. Joe holds a BSCE from Boston University.

Companies and governments use various techniques to investigate when computer break-ins happen, and to learn more about potential intruders. But these techniques can invade the privacy of entities other than the suspect, and violate privacy laws. Additionally, regulations may define different investigative techniques themselves as attacks or intrusions. There is little legal guidance in this area, and a lot of uncertainty. This talk will discuss the legality and of network scans, war driving, borrowing wireless connectivity, sniffers, "hack-back", social engineering and other techniques under U.S. law.

Jennifer Stisa Granick joined Stanford Law School in January 2001, as Lecturer in Law and Executive Director of the Center for Internet and Society (CIS). She teaches, speaks and writes on the full spectrum of Internet law issues including computer crime and security, national security, constitutional rights, and electronic surveillance, areas in which her expertise is recognized nationally.

Granick came to Stanford after almost a decade practicing criminal defense law in California. Her experience includes stints at the Office of the State Public Defender and at a number of criminal defense boutiques, before founding the Law Offices of Jennifer S. Granick, where she focused on hacker defense and other computer law representations at the trial and appellate level in state and federal court. At Stanford, she currently teaches the Cyberlaw Clinic, one of the nation's few law and technology litigation clinics.

Granick continues to consult on computer crime cases and serves on the Board of Directors of the Honeynet Project , which collects data on computer intrusions for the purposes of developing defensive tools and practices. She was selected by Information Security magazine in 2003 as one of 20 "Women of Vision" in the computer security field. She earned her law degree from University of California, Hastings College of the Law and her undergraduate degree from the New College of the University of South Florida.

This talk provides an overview of the RF-ID Smart-Labes, small labels on products with an embedded microchip and an antenna. Smart-Labes store product and serial-number, expiration date etc. and can be read from a distance.

The Industry is planning to put these labels with an international product code on every product within the next decade, effectively replacing the old bar-code system. Some stores already use Smart-Labes, for example certain pharmacies in the US, and in Europe the Metro Group in their Future Store.

At the end of this talk there is a practical demonstration of RF-DUMP, my tool to read and write Smart-Labes, check their meta-data and manipulate it.

Lukas Grunwald is the CTO of DN-Systems Enterprise Internet Solutions GmbH (Hildesheim/Germany)— a globally acting consulting office working mainly in the field of security and internet/eCommerce solutions for enterprises.

Mr. Grunwald has been working in the field of IT security for nearly 15 years now. He is specializing in security of wireless and wired data and communication networks, Forensic Analysis, Audits and Active Networking. Mr. Grunwald regularly publishes articles, talks and press releases for specialist publications. He also participates actively in conferences such as Hackers at Large, Hacking in Progress, Network World, Internet World, Linux World (USA/Europe), Linux Day Luxembourg, Linux Tag, CeBIT Conference.

Honeynets are one of the more recent toys in the white-hat arsenal. They are usually assumed to be hard to detect and attempts to detect or disable them can be unconditionally monitored. Sometimes it is even suggested that deploying honenets is a way to incerase security.

We scrutinize this assumption and demonstrate a method how a host in a honeynet can be completely controlled by an attacker without any substantial logging taking place. We show how to detect honeynets, circumvent logging on a honeynet and finally 0wn a honeynet hard disabling all of a honeypots security features and present the tools to do so.

While being fairly technical the a basic knowledge how shellcode and the like works should be enough to follow the talk.

Maximillian Dornseif has studied laws and computer science at the University of Bonn, Germany where he wrote his PhD Thesis about the "Phenomenology of Cybercrime". He has been doing security consulting since the mid nineties. His clients included the industry but also government. At the moment he works on a third party founded research project about measurement of security and security breaches taking place at the Laboratory for Dependable Distributed Systems, RWTH Aachen University. He also oversees several other projects in the area of detection and documentation of security incidents. Dornseif has published in the legal and computer science fields on a wide range of topics.

Thorsten Holz is a research student at the Laboratory for Dependable Distributed Systems at RWTH Aachen University where he is trying to bring a solid scientific foundation to Honeynet research. He is going to graduate next spring and will probably continue his studies as a Ph.D. student.

Because of improper software design and implementation practices, the number of web-based applications vulnerable to SQL injection is still alarmingly high. Yet the actual steps used to exploit these applications remain very tedious and repetitive. This presentation will focus on methods available to automate the task of exploiting blind sql injection holes and will discuss the use of pattern recognition in the domain of web applications. This talk will also feature a new tool, "SQueaL" and explain some of the research, decisions and algorithms used in the creation of this tool.

Cameron Hotchkies, aka nummish, is a member of the 0x90.org digital think-tank. He currently works outside the security industry developing business based web applications  on the .NET platform. Outside of work, he generally spends most of his time writing code. Some people have suggested he get out more. He is currently struggling to write code to teach him how to properly pronounce the word "about".

The WorldWide WarDrive is an effort by security professionals and hobbyists to generate awareness of the need by individual users and companies to secure their access points. The goal of the WorldWide WarDrive (or WWWD) is to provide a statistical analysis of the many access points that are currently deployed. Chris Hurley (aka Roamer), the founder of the WorldWide WarDrive will present a statistical analysis of the results from the fourth WorldWide WarDrive and an analysis of those results compared to past years.

Chris Hurley (aka Roamer) is an Information Assurance Engineer working in the Washington D.C. area and is the author of "WarDriving: Drive, Detect, Defend". A Guide to Wireless Security from Syngress Publishing. His experience ranges from Security Engineering and Architecture to vulnerability assessments and penetration testing on both wired and wireless networks. In addition to running the WorldWide WarDrive he organizes the annual DefCon WarDriving contest.

The Domain Name System is a powerful, flexible, and integral part of the Internet. Somewhat analogous to the 411 information service offered throughout American telephone system, DNS's most common use is to translate names—such as www.blackhat.com—to addresses— 216.231.63.34. But behind this deceptively simple operation lies a complex and interesting system, distributed widely but with a deeply centralized core. Though most commonly used to execute simple translations of the sort mentioned earlier, three aspects of the machinery lend themselves to more creative exploits. By creatively abusing the heirarchal, recursive, and cache-oriented nature of the multi-million-node DNS architecture, we can effect a range of unexpected functionality, including firewall penetration, bidirectional anonymous communication, large scale data transmission, and even "Voice over DNS".

Dan Kaminsky, also known as Effugas, is a Senior Security Consultant for Avaya's Enterprise Security Practice, where he works on large-scale security infrastructure. Dan's experience includes two years at Cisco Systems designing security infrastructure for large-scale network monitoring systems. He is best known for his work on the ultra-fast port scanner scanrand, part of the "Paketto Keiretsu", a collection of tools that use new and unusual strategies for manipulating TCP/IP networks. He authored the Spoofing and Tunneling chapters for "Hack Proofing Your Network: Second Edition", was a co-author of "Stealing The Network: How To Own The Box", and has delivered presentations at several major industry conferences, including Linuxworld, DefCon, and past Black Hat Briefings. Dan was responsible for the Dynamic Forwarding patch to OpenSSH, integrating the majority of VPN-style functionality into the widely deployed cryptographic toolkit. Finally, he founded the cross-disciplinary DoxPara Research in 1997, seeking to integrate psychological and technological theory to create more effective systems for non-ideal but very real environments in the field. Dan is based in Silicon Valley.

You can contact dan at: kaminsky at avaya døt com and www.avaya.com/security

Viagra! Work from home! Who sends this stuff? And what if not all Spam is what appears to be? This talk discusses forensic methods for identifying forged emails and tracking individual senders who would otherwise be anonymous.

This presentation demonstrates how to apply data forensics to spam in order to identify the sender of specific spam messages. Some senders can be identified by name, while others can be distinguished by attributes such as preferences, nationality, religion, and even left-handedness.  Five spam categories are provided that classify spam by function, including List Makers, Scams, and Covert Communication channels. The examples provided include full-disclosure case studies: a phishing gang that targets bank customers with malware and impersonations, and an IRC group that uses spam as a covert communication channel.

Curtis Kret has a Ph.D. in Computer Science and over 15 years of computer security experience. His current research focuses on methods to track “anonymous” people and applying the research to spam. Dr. Kret is a researcher for Secure Science Corporation’s External Threat Assessment Team.

Secure Science Corporation is a professional services and software company that develops advanced technology dedicated to protecting online assets.  Secure Science Corporation is pioneering innovative ways to transform the Internet into a secure environment for both online communications and transactions.

In November 2003, Adam Laurie of A.L. Digital Ltd. discovered serious flaws in the authentication and data transfer mechanisms on some bluetooth enabled devices, and, in particular, mobile phones including commonly used Nokia and Sony Ericsson models. Shortly thereafter, Martin Herfurt of Salzburg Research Forschungsgesellschaft mbH expanded on these problems, and teamed up with Adam to investigate further.

This talk will cover the issues arising out of these flaws, including loss of personal data, identity theft, phone tapping, tracking, fraud and theft of service. The threat to individuals and corporates will be examined, and statistics and examples from the real world presented, as well as live demonstrations of each of the problems.

This will be a fun talk and a real eye-opener for those with bluetooth enabled devices.

For further background information on the issue, see:
http://www.thebunker.net/release-bluestumbler.htm

Adam Laurie is Chief Security Officer and Director of AL Digital Ltd. and The Bunker. He started in the computer industry in the late Seventies, working as a computer programmer on PDP-8 and other mini computers, and then on various Unix, Dos and CP/M based micro computers as they emerged in the Eighties. He quickly became interested in the underlying network and data protocols, and moved his attention to those areas and away from programming, starting a data conversion company which rapidly grew to become Europe's largest specialist in that field (A.L. downloading Services). During this period, he successfully disproved the industry lie that music CDs could not be read by computers, and, with help from his brother Ben, wrote the world's first CD ripper, 'CDGRAB'. At this point, he and Ben became interested in the newly emerging concept of 'The Internet', and were involved in various early open source projects, the most well known of which is probably their own—'Apache-SSL'—which went on to become the de-facto standard secure web server. Since the late Nineties they have focused their attention on security, and have been the authors of various papers exposing flaws in Internet services and/or software, as well as pioneering the concept of re-using military data centres (housed in underground nuclear bunkers) as secure hosting facilities. Adam has been a senior member of staff at DEFCON since 1997, and also acted as a member of staff during the early years of the Black Hat Briefings.

Martin Herfurt is a researcher at the Salzburg Research Forschungsgesellschaft m.b.H and lecturer in Telecommunications Engineering Degree Program at the Salzburg University of Applied Sciences and Technologies.

He completed his Telecommunications Engineering Degree at the Salzburg University of Applied Sciences and Technologies in 2001. Alongside his study Martin was involved in numerous industry projects, providing him with commercial programming practise.

In 2000 Martin followed up his formal study with a four-month internship at the telecommunications institute of TELCOT institute in San Ramon, California, USA.

Since the second half of 2000 Martin has been working as a full time researcher at Salzburg Research Forschungsgesellschaft m.b.H. His project responsibilities range from the co-ordination of a European IST project with a total budget of over 5 million Euro to software agents development.

Together with a Salzburg Research colleague, Martin began in the summer of 2003 a class on mobile data services at the Salzburg University of Applied Sciences and Technologies.

Martin is also currently working on a PhD in computer science at the University of Salzburg.

As part of his fascination with the rapid development in computer programming Martin has become a regular participant in the Chaos Communication Congress which is a yearly meeting of the German hacker association CCC.

This presentation will be entirely new and never seen before. Code included.

David Litchfield leads the world in the discovery and publication of computer security vulnerabilities. This outstanding research was recognised by Information Security Magazine who voted him as 'The World's Best Bug Hunter' for 2003. To date, David has found over 150 vulnerabilities in many of today's popular products from the major software companies (the majority in Microsoft, Oracle).

David is also the original author for the entire suite of security assessment tools available from NGSSoftware. This includes the flagship vulnerability scanner Typhon III, the range of database auditing tools NGSSquirrel for SQL Server, NGSSquirrel for Oracle, OraScan and Domino Scan II.

In addition to his world leading vulnerability research and the continued development of cutting edge security assessment software, David has also written or co-authored on a number of security related titles including, "SQL Server Security", "Shellcoder's handbook" and "Special Ops: Host and Network Security for Microsoft, UNIX and Oracle"

This presentation explores the explosive growth of a technique known as "Google Hacking". When the modern security landscape includes such heady topics as "blind SQL injection" and "integer overflows", it's refreshing to see such a deceptively simple tool bent to achieve such amazing results; this is hacking in the purest sense of the word. Attendees will learn how to torque Google to detect SQL injection points and login portals, execute portscans and CGI scans, fingerprint web servers, locate incredible information caches such as firewall and IDS logs, password databases, SQL dumps and much more - all without sending a single packet to the target! Borrowing the techniques pioneered by malicious "Google hackers", this talk aims to show security practitioners how to properly protect clients from this often overlooked and dangerous form of information leakage.

The speaker, Johnny Long, maintains the Internet's most comprehensive database of Google exposures on his website.

Johnny Long did not develop his skills within the hallowed halls of higher learning but rather by spending way too many late nights huddled in front of his computer, developing his anti-social tendencies.

Mr Long (Johnny's professional alter-ego) has previously presented at SANS and other computer security conferences nationwide. In addition, he has presented before several government alphabet-soup entities including three starting with the letter 'A', four starting with the letter 'D', a handful starting with the letters 'F' and 'S' and two starting with the today's letter, the letter 'N'. During his career as an attack and penetration specialist, Mr Long has performed active network and physical security assessments (one in the cube is worth twenty on the net) for hundreds of government and commercial clients.

Johnny Long is the Author of 'Penetration Testing with Google', available December 2004 from Syngress Publishing

During the course of 2003, Mr. Kevin Mandia responded to over 20 computer security incidents at some of America’s largest organizations.  Mr. Mandia was on the front lines assisting these organizations in responding to international computer intrusions, theft of Intellectual Property, electronic discovery issues, and widespread compromise of sensitive data. During his efforts to resolve these incidents, many similar challenges and issues confronted each organization. During this presentation, Mr. Mandia re-enacts some of the incidents, provides examples of how these incidents impacted organizations, and discusses the challenges that each organization faced.  He demonstrates the “State-of-the-Art” methods being used to perform Incident Response, and how these methods have not really evolved since 1988. He outlines the need for new technologies to address these challenges, and what these technologies would offer. He concludes the presentation by discussing emerging trends and technologies that offer strategic approaches to minimize the risks an organization faces from the liabilities the information age has brought. 

Kevin Mandia has amassed a wealth of experience and expertise as a Special Agent, consultant, and instructor. The FBI's National Infrastructure Protection Center, the Air Force Office of Special Investigations (AFOSI), state law enforcement, and corporate entities have all used his blend of law enforcement and technical skills on complex computer crimes. His experience runs the gamut from international computer intrusion cases to corporate insider hacking cases. Mr. Mandia was a Special Agent with the AFOSI specializing in computer intrusion cases. Upon leaving the AFOSI, Kevin developed a computer intrusion response course specifically designed for the FBI. Mr. Mandia trained over 400 FBI agents as well as personnel from the State Department, the CIA, NASA, the U.S. Postal Service, the Air Force, and other Government Agencies. In the last 3 years. Mr. Mandia has led incident response teams that have been involved in over 40 computer security incidents at eCommerce and Financial Service organizations. Mr. Mandia is co-author of “Incident Response: Performing Computer Forensics” (McGraw-Hill, 2003) and "Incident Response: Investigating Computer Crime" (McGraw-Hill, 2001).  He holds a B.S. in Computer Science from Lafayette College and a M.S. in Forensic Science from the George Washington University. He is a reserve Special Agent with AFOSI, a Certified Information Systems Security Professional (CISSP), and he continually assists the FBI, the US Attorneys Office, and other law enforcement on active cases.

Many advances have happened in the security arena over the last few years. With new technologies being deployed attackers are having to attack in and stealthier ways. The most impact would come from attacking an application before its built, or while its in the process of being built. Through a series of examples it will be clear that not only should you worry about what is in your code, but how it is built. Trojaning a compiler to automatically backdoor every binary being built is not only possible, its easy. This talk will show how the attack can occur and the results of it. This attack is not just limited to opensource compilers, Microsoft Visual Studio will be attacked as well.

David Maynor is a research engineer with the ISS Xforce R&D team. Before ISS Maynor spent the 3 years at GaTech, with the last two years as a part of the Information Security group as a application developer to help make the sheer size and magnitude of security incidents on campus manageable. Before that Maynor contracted with a variety of different companies in a widespread of industries ranging from digital tv development to protection of top 25 websites to security consulting and penetration testing to online banking and ISPs.

The California recall election, held October 7, 2003, was controversial on a number of levels. It was the first such Gubernatorial challenge in the state's history, it sported a slate of 134 candidates (from computer gurus to actors), and it was nearly delayed by a legal challenge from the ACLU on the grounds of potential disenfranchisement of certain population groups. The complex set of resulting vote data, from 58 counties using a diverse range of equipment, was subsequently misinterpreted to promote various agendas. This talk will lend insight on what may await the US in November 2004 by providing an analysis that dispels erroneous assertions about the benefits of electronic voting, while raising strong questions about both the accuracy of election systems and the reports generated from them.

Dr. Rebecca Mercuri became an overnight celebrity during the media frenzy that ensued when the U.S. Presidential election ended in a dead heat in November 2000. A few weeks earlier, she had successfully defended her Doctoral Dissertation "Electronic Vote Tabulation: Checks and Balances" at the University of Pennsylvania, and then found herself writing testimony in the now-legendary Bush v. Gore case that was working its way through the legal system. Her testimony was presented to the U.S. 11th Circuit Court of Appeals and referenced in the briefs to the U.S. Supreme Court. Since then, she has provided formal testimony on voting systems to the House Science Committee, Federal Election Commission, U.S. Commission of Civil Rights, and the U.K. Cabinet, has been quoted in the U.S. Congressional Record, and has played a direct role in municipal, state, federal, and international legislative initiatives. Rebecca's comments on election technology are frequently cited by the media, and she authors the quarterly "Security Watch" column in the Communications of the Association for Computing Machinery (archived at www.notablesoftware.com). Having recently completed a research fellowship at the John F. Kennedy School of Government in their Belfer Center for Science and International Affairs, Dr. Mercuri will be moving to Harvard University's Radcliffe Institute in the Fall.

Bev Harris, author of "Black Box Voting: Ballot-Tampering in the 21st Century," began writing on the subject of electronic voting machines in October 2002. Her investigative journalism has since been cited in The New York Times (three times), and on CBS, Fox News, and CNN. In writing Black Box Voting, Harris spent over two thousand hours researching voting machines, and interviewed hundreds of witnesses including many election officials and even voting machine programmers who work directly for the firms that build these machines. During the course of writing Black Box Voting, Harris discovered that one of the largest voting machine companies, Diebold Election Systems, had committed a massive security breach, leaving thousands of sensitive voting system program files on an unprotected Web site. These files have now triggered a national investigation and activism movement to restore clean, trustworthy voting systems.

The Global Security Syndicate (GSS), www.gssyndicate.com, is a not for profit group of security professionals focused on identifying and implementing best security practices. The GSS will provide important feedback to the security community through focused projects around specific security related topics. The GSS will also serve as a source of information related to international security organizations that have a proven track record in meeting the security needs of customers in specific security topic areas. Come attend this TurboTalk and participate in the kickoff of the GSS.

Gregory S. Miles, Ph.D., CISSP, CISM
Greg is a 16 year + technology and information security veteran and serves as the President and CFO for Security Horizon, a Colorado Springs based information security professional services firm. He is a United States Air Force Veteran and has served in military and contract support for the National Security Agency, Defense Information Systems Agency, Air Force Space Command, and NASA supporting world-wide security efforts. Greg has planned and managed Computer Incident Response Teams (CIRT), Computer Forensics and INFOSEC training capabilities. He has experience with International and U.S. based security legislative requirements and standards to include ISO 17799, Gramm-Leach-Bliley Act (GLBA), HealthCare Information Portability and Accountability Act (HIPAA), and NIST 800 series. He has served in various information security positions throughout his career to include Director, Cyber Crime Response, INFOSEC Program Manager, Chief Engineer and Senior INFOSEC Engineer. Greg has been published in multiple periodicals to include “The Security Journal” and “The International Journal on Cyber Crime”.  He has also co-author of “Security Assessment: Case Studies for Implementing the NSA IAM”. Greg holds a BS in Electrical Engineering from the University of Cincinnati, an MS in Management from Central Michigan University, and a Ph.D. in Engineering Management from Kennedy-Western University. Greg is an instructor for the University of Advancing Technology (UAT) in their security degree program.

Travis Schack, CISSP, CCNA
Travis is an 10 year + technology and information security veteran and is the President of Vitalisec, a Denver based information security professional services firm. Travis is versed in Information Security Management; Security Policy Development and Implementation; Disaster Recovery Planning; Intrusion Detection Development; Implementation and Administration; Firewall Administration; Incident Handling and Reporting Procedures; Physical Security Management; LAN-WAN Engineering and Architecture; Windows and Unix System Administration; Risk and Vulnerability Assessment; Penetration Testing. Travis has worked as a Security Professional in the network communications and financial industries, where he performed numerous security application reviews as well as network attack and penetration tests against UNIX, Linux, and Windows systems. He has extensive knowledge in the area of attack methodologies, attack tools, wireless networking, computer security policy and standards, and intrusion detection. Travis is an instructor for Denver University's Master's program in Information Security.

Evasion and Detection of Web Application Attacks
K. K. Mookhey, Founder & CTO, Network Intelligence India Pvt. Ltd.

Intrusion detection systems that work at the application layer appear to be the next new wave of security products to hit the market. As with network IDSs, some of the products in the application security space work with signatures, while others are anomaly based. This presentation looks at typical patterns produced by some of the more common web application attacks—SQL injection, cross-site scripting, directory traversal, buffer overflows, etc. It discusses how these attacks can be matched using regular expression based signatures on the Snort IDS. However, the difficult part comes in trying to write signatures that cannot be easily evaded, while still keeping false positives at an acceptable level.

Advanced attacks to try and evade these signatures and modifications to the original set of signatures are discussed. The original concept is expanded to use these signatures with mod_security for Apache, and SecureIIS for IIS. We then discuss the security attacks that cannot be detected by signature-based methods. Anomaly-based methods of detecting web application attacks are also briefly covered.

The attendees are expected to be familiar with regular expressions and the basics of typical web application attacks.

K. K. Mookhey is the Founder and Chief Technology Office of Network Intelligence (www.nii.co.in), an information security consulting firm. He has provided security consulting services to Fortune 500 companies and industry segment leaders in India, Middle East, and North America. He has pioneered the development of the AuditPro suite of security auditing software, as well as initiated the research efforts within the company. His vulnerability research team has found security vulnerabilities in products from vendors such as Oracle, Symantec, and Macromedia. He is a regular contributor to the Infocus series of articles on SecurityFocus, as well as various industry journals such as IS Control and IT Audit. He is the author of a monograph on "Linux Security Audit and Controls" commissioned by the Information Systems Audit and Control Association (ISACA). He is also the author of the chapter on “Web Application Attacks” in the upcoming version of the OWASP Guide.

Shoot the Messenger— Using Window Messages to Exploit Local win32 Applications
Brett Moore, CTO, security-assessment.com

The windows GDI interface uses messages to pass input and events to windows. As there is currently no way of determining who the sender of the message is, it is possible for a low privileged application to send messages to and interact with a process of higher privilege.

This presentation will cover in details some of the flaws exposed through these messages, and demonstrate how they can be exploited to conduct privilege escalation and other attacks. Attendees should be familiar with the shatter attack concept and may want to review the following documents before attending:

• Shatter Attacks - How to break Windows, Chris Paget
• Win32 Message Vulnerabilities Redux, Oliver Lavery
• Shattering by Example, Brett Moore

Brett Moore leads the security research and network intrusion teams at security-assessment.com. He has been credited with the discovery of multiple security vulnerabilities in both private and public software vendors’ products including Microsoft web products.

Robert Morris received a B.A. in Mathematics from Harvard University in 1957 and a M.A. in Mathematics from Harvard in 1958. He was a member of the technical staff in the research department of Bell Laboratories from 1960 until 1986. On his On his retirement from Bell Laboratories in 1986 he began work at the National Security Agency. From 1986 to his (second) retirement in 1994, he was a senior adviser in the portion of NSA responsible for the protection of sensitive U.S. information.

In a cyberworld of never ending struggles, defenders might have a new weapon in the future in order to defeat attackers. This talk will focus on those possibilities called: digital active self defense.

For example, after a compromission, a victim might want to react and even hack back the aggressor. This potentialy natural idea might not be legal most of the time, and many drawbacks exist. Think about the case where an aggressor would use a connectionless attack; the source of the intrusion could not be the real one (spoofing) so that a retaliation would not be a good idea!

This presentation aims at sharing ideas about digital active self defense to focus on the essential current questions: why and when should we try to react like that? How could we play with incoming aggressors in order to limit the risks? What would be the limitations of such solutions (legal and technical issues)?

As a conclusion, we will evaluate the potential hidden by those technologies used for Information Assurance and imagine future kind of solutions, digital active self defense systems.

Laurent Oudot is a French security expert who works for the CEA. He is also a member of a team called "rstack" composed of security addicts and geeks. Oudot's research focus on defensive technologies highly closed to blackhats activities like honeypots, intrusion prevention, intrusion detection, firewalls, sandboxes, MAC, etc.

Laurent is the (co-)author of several research papers recently published and released at rstack.org, MISC magazine and Linux Magazine France. He has presented at national and international conferences and meetings such as annual Honeynet Project meeting (Chicago), Libre Software Meeting (Metz), FOSDEM (Bruxelles), etc.

In his spare time, Laurent co-organized security events such as the Libre Software Meeting (co-chairman of the Security Topic with Bradley Spengler from Grsecurity), Symposium Sécurité des Technologies de l'Information et de la Communication (SISTIC), etc.

Laurent teaches network and systems security, and has managed numerous security projects..

Recently with Nicolas Fischbach, he co-created the French Honeynet Project which is part of the international Alliance of Honeynets.

Ponemon Institute recently conducted two independent surveys concerning individual privacy rights. The first study examines the public's perception concerning the safety and security of e-voting systems. The second study explores the public's reaction to the U.S. government's CAPPS II proposal that requires airlines to share personal data about passengers with the Department of Homeland Security. Dr. Larry will present an analysis that compares and contrasts the "Black Hat" community to members of the general public in terms of perceptions and beliefs about privacy issues.

Dr. Larry Ponemon is Chairman of Ponemon Institute, a "think tank" dedicated to privacy, data protection and information security policy research. He is also serves as an adjunct professor of privacy and ethics at Carnegie Mellon University's CIO Institute and CyLab.

No matter where we go online or in the real world, we are being tracked.  Security cameras, web logs, and cell towers know where we were, what we bought, and who we were with. As technology has advanced the ability to track users has become more widespread. And with huge companies like Microsoft, T-mobile, and Google, tracking information from multiple sources can be correlated and used to obtain a deep understanding of each one of us.

The privacy ramifications of this technology are far reaching. However, in order to fully understand the privacy ramifications, we must understand the technology used for tracking and how this technology is currently being used.  This talk will attempt to lend clarity to the privacy issues created because of user tracking by describing the landscape of tracking technologies employed today. Wireless, biometric, and logical techniques will be described.  Real world examples will be discussed so you have a clear idea of what you are exposed to on a daily basis. For each example, the privacy ramifications will be discussed as well as mechanisms for defeating the tracking itself.

During this talk, there will be a demonstration and release of a proximity-based Bluetooth tracking tool. Audience members who wish to participate will be asked to leave their phone in discoverable mode throughout the conference so they can be tracked via a conference-accessible webbrowser.

Bruce Potter is a Senior Associate with Booz Allen Hamilton. Mr. Potter is the founder of the Shmoo Group of security professionals. His areas of expertise include wireless security, large-scale network architectures, smartcards and promotion of secure software engineering practices. Mr. Potter coauthored the books "802.11 Security", published in 2003 by O’Reilly and Associates, and "Mac OS X Security" published by New Riders in May 2003. Mr. Potter is coauthoring "Master FreeBSD and OpenBSD Security" with O’Reilly and Associates with a publication date in summer 2004. Mr. Potter was trained in computer science at the University of Alaska, Fairbanks.

Steganography, Steganalysis, & Cryptanalysis
Michael T. Raggo, Principal Security Consultant, VeriSign

This presentation will present Steganography and techniques for Steganalysis (identifying files with hidden messages). A review of Steganography will provide the basis for identifying and dissecting carrier files. There will also be a demonstration of carrier file analysis and disection. There will also be a demo of my new Steganography detection program, StegSpy. Cracking and reverse-engineering Steganography programs will also be covered. A cryptanalysis case study will review the steps necessary to reverse engineer and reveal a hidden message. Additionally, other steganalysis and password cracking tools will be highlighted.

Michael T. Raggo (CISSP, IAM, CCSA, CCSE, CCSI, MCP, SCSA) is a Principal Security Consultant for VeriSign, Inc. As a consultant, Mr. Raggo architects and deploys firewalls, intrusion detection systems, and PKI solutions. In addition, he also performs security assessments, penetration tests, and forensics investigations. He is also an instructor for VeriSign’s suite of security classes including Applied Hacking and Countermeasures and the author of StegSpy, a steganography detection program.

Mr. Raggo is a guest speaker at nationwide conferences including SANS, WebSec and InfoSec. Prior to joining VeriSign, Mr. Raggo was Supervisor of System Administration for www.nasdaq.com at the NASDAQ Stock Market. Mr. Raggo has 15 years experience in the information systems field including experience as a UNIX System Administrator, Network Administrator, and Firewall Administrator.

Mr. Raggo conducted graduate work in Information Systems at Johns Hopkins University. Prior to that, he earned his BSET in Electrical Engineering from Rochester Institute of Technology.

The Keys to the Kingdom: Understanding Covert Channels of Communication
Russ Rogers, CEO, Security Horizon

Security professionals see the compromise of networked systems on a day to day basis. It's something they've come to expect. The blatant exploitation of operating systems, applications, and configurations is a common event and is taken into account by most security engineers. But a different type of security compromise threatens to crumble the underlying security of the modern organization.

There are forms of communication that transfer sensitive data outside of organizations every day. Covert channels are used to move proprietary information in and out of commercial, private, and government entities on a daily basis. These covert channels include things such as Steganography, Covert network channels, Data File Header and Footer Appending, and Alternate Data Streams. Media to be covered include images, audio files, TCP covert channels, Word substitution mechanisms, the Windows file system and others.

This presentation will show the attendees common means of covert communication by hiding information through multiple means. We'll also discuss the future of Covert Channels and how hidden information is becoming more and more difficult to detect. Detection of these forms of communication is trailing well behind the technology creating them, this presentation will discuss some of the newest concepts in utilizing Covert Channels and Steganography.

Russ Rogers is the CEO of Security Horizon, a Colorado Springs based information security professional services firm and is a technology veteran with over 13 years of technology and information security experience. He has served in multiple technical and management information security positions that include Manager of Professional Services, Manager Security Support, Senior Security Consultant and Unix Systems Administrator. Mr. Rogers is a United States Air Force Veteran and has supported the National Security Agency and the Defense Information Systems Agency in both a military and contractor role. Russ is also an Arabic Linguist. He is a certified instructor for the National Security Agency's INFOSEC Assessment Methodology (IAM) and INFOSEC Evaluation Methodology (IEM) courses. He holds his M.S. degree from the University of Maryland is also a Co-Founder of the Security Tribe (securitytribe.com), a security think tank and research organization.

The Anonymity Toolkit
Len Sassaman

Today's Internet is fraught with privacy dangers. Users in both the consumer and enterprise environments are becoming increasingly aware of the need for privacy protection services to accompany their Internet access, but the available solutions are less than intuitive.

We present a model of privacy measurement as the ability to remain anonymous to attackers with varying degrees of sophistication, and identify the key components to a total anonymity solution. We review and evaluate the many competing privacy and anonymity software solutions which fulfill the requirements for each component in the total solution, and describe the situations under which each excels or fails.

Explanations of the theoretical basis for the more advanced anonymity and privacy software featured in the talk will be given. The less advanced privacy software will be debunked. Some of the software solutions to be discussed include the Java Anonymous Proxy, The Onion Router, Privoxy, Middleman, Freenet, and GNUnet.

Len Sassaman is a communication security consultant specializing in Internet privacy and anonymity technologies. Formerly the security architect for Anonymizer and a software engineer for PGP Security, Len is now focusing on research in the area of practical attack-resistant anonymity systems which can be widely deployed and used by large groups. Additionally, Len is an anonymous remailer operator, and maintainer of the oldest actively-used anonymity software, Mixmaster.

When the Tables Turn
SensePost

Until now network security defences have largely been about building walls and fences around the network. This talk revolves around spiking those walls & electrifying those fences! During this talk we will highlight techniques (and tools) that can be used to turn the tables on prospective attackers with passive-Strike-Back. We will explore the possibilities across the assesment spectrum responding to the standard assesment phases of Intelligence gathering, Reconnaissance & Attack with Disinformation, Misdirection, Camouflage, Obfuscation & Proportional Response.

Roelof Temmingh is the Technical Director of SensePost where his primary function is that of external penetration specialist. Roelof is internationally recognized for his skills in the assessment of web servers. He has written various pieces of PERL code as proof of concept for known vulnerabilities, and coded the world-first anti-IDS web proxy "Pudding". He has spoken at many International Conferences and in the past year alone has been a keynote speaker at SummerCon (Holland) and a speaker at The Black Hat Briefings. Roelof drinks tea and smokes Camels.

Haroon Meer is currently SensePost's Director of Development (and coffee drinking). He specializes in the research and development of new tools and techniques for network penetration and has released several tools, utilities and white-papers to the security community. He has been a guest speaker at many Security forums including the Black Hat Briefings. Haroon doesnt drink tea or smoke camels.

Charl van der Walt is a founder member of SensePost. He studied Computer Science at UNISA, Mathematics at the University of Heidelberg in Germany and has a Diploma in Information Security from the Rand Afrikaans University. He is an accredited BS7799 Lead Auditor with the British Institute of Standards in London. Charl has a number of years experience in Information Security and has been involved in a number of prestigious security projects in Africa, Asia and Europe. He is a regular speaker at seminars and conferences nationwide and is regularly published on internationally recognized forums like SecurityFocus. Charl has a dog called Fish.

Defeating Automated Web Assessment Tools
Saumil Udayan Shah, Director, Net-Square Solutions

Previously, Saumil held the position of Director of Indian operations with Foundstone Inc. in the US, and a senior consultant with Ernst & Young's Information Security Services. Saumil has also worked at the Indian Institute of Management, Ahmedabad, as a research assistant and is currently a visiting faculty member for their Management Development Programmes.

Saumil graduated from Purdue University with a master's degree in computer science and a strong research background in operating systems, networking, infomation security, and cryptography. He also holds a CISSP certification. He got his undergraduate degree in computer engineering from Gujarat University, India. Saumil is also the author of "The Anti-Virus Book" (Tata McGraw-Hill, 1996)

Web Application Session Strength
Michael Shema, Director of Research, NT Objectives

Web applications handle user session management in a variety of ways and levels of security. The most common technique uses a session token such as a Cookie, HTTP Header, HTML form input element, or URL parameter. If this token is created and manipulated in an insecure manner, then the application is vulnerable to identity theft attacks, user impersonation, privilege escalation, and authentication bypass. Unlike SQL injection or Cross-Site Scripting, which rely on syntax attacks, a session attack is not affected by validation filters or application-level firewalls. Consequently, it is necessary to understand how secure tokens are created, encoded, and encrypted to prevent unauthorized manipulation and minimize the impact of a stolen value. Real-life examples are included, along with secure coding countermeasures to protect session tokens from prediction and manipulation attacks.

Mike Shema is Director of Research & Development at NT Objectives where he focuses on assessment and mitigation strategies for all aspects of web application security.

Prior to joining NT OBJECTives, Mr. Shema worked as a Principal Consultant at Foundstone where he performed network penetration tests, web application security assessments, and wireless network security audits. In this time Mr. Shema led security audits for Fortune 100 companies, financial institutions, and large software development companies. Diverse clients and application platforms have enabled Mike to field-test and expand security methodologies, techniques, and tools across the entire enterprise security industry.

Mr. Shema previously worked at a product development company where he configured and deployed high-capacity Apache web and Oracle database servers for numerous Internet clients; and also worked at Booz Allen Hamilton where he conducted security assessments for government and military networks across the country.

His experience with Web application security has led to several Bugtraq advisories, co-authorship of "Hacking Exposed: Web Applications", and authoring "Hack Notes: Web Application Security". He has also co-authored "The Anti-Hacker Toolkit", now in its second edition. He has taught at the Black Hat conferences in Las Vegas, Singapore, and Amsterdam, and continues to speak regularly at premier industry conferences and events around the world.

Mr. Shema's other writing credits include technical columns about Web server security for Security Focus and DevX and technical editor for Incident Response: Investigating Computer Crime. He holds B.S. degrees in Electrical Engineering and French from Penn State University.

A Comparison of Buffer Overflow Prevention Implementations and Weaknesses
Peter Silberman, Security Engineer, iDEFENSE
Richard Johnson, Senior Security Engineer, iDEFENSE

Buffer overflows are historically the most commonly exploited software vulnerability in the security world. The last year has seen effective automated attacks such as the MS Blaster worm and SQL Slammer worms. Due to the rapid growth of worm technology and readily available automated worm generation tools, the need for buffer overflow protection software has dramatically increased.

This presentation will give the attendee an overview of the methods used by current stack protection technology.

We will discuss the varying types of stack overflow protection available for the Linux and Windows operating environments and the weaknesses that lie within each implementation. This will also be the first public discussion of available third-party buffer overflow prevention software for the Windows operating system. The test suite used to analyze the exploitability of common software vulnerabilities has been modified with specialized shellcode to be used against buffer overflow protection methods. A demonstration will be provided and the tool is available to attendees for future testing of protection software.

The attendee should have basic knowledge of buffer overflow exploitation, but the presentation will build on itself, and in the end offer a tool that anyone can use to test their buffer overflow protection software.

Peter Silberman is a Security Engineer at iDEFENSE. Peter works in the iDEFENSE labs where he conducts vulnerability research. He is especially interested in advanced exploitation of the win32 platform, buffer overflow protection methods, and windows forensic analysis. Peter has been a professional vulnerability researcher for a year, and has spent two or three years as an independent researcher.

Richard Johnson is a Senior Security Engineer at iDEFENSE. He works in the iDEFENSE Labs where he is responsible for conducting vulnerability research, malicious code analysis, and developing reverse code engineering tools and methodologies. Areas of interest include run-time process modification, live kernel patching, embedded systems reverse engineering, and seeing how much beer a man can drink in an evening. With three years professional vulnerability research experience, and many more as a hobbist, he is considered a valuable resource with a wide breadth of knowledge at iDEFENSE Labs.

Payloads intended to execute attacker-provided code typically require a static address of code already existing in the vulnerable process's address space, in order to redirect execution back into code accompanying the payload. Historically, exploit authors have resorted to finding the addresses of byte sequences that perform a call or jump to the address loaded in a register at the moment when execution can be hijacked. These "return addresses" are typically infrequent in an address space and may vary with the version of the program being attacked, making the discovery of version-independent or character-restricted addresses extremely rare. With the "EEREAP" (eEye Emulating Return Address Purveyor) project, we aim to revolutionize the practice of return address discovery by employing machine code emulation and exceptionally more finely-grained context awareness in order to exhaustively locate the addresses in an address space that are suitable to redirect execution into payload data. In this presentation, we will discuss how EEREAP works, how to use it as a tool for exploit coding, and what can be accomplished with this new generation of return address enumeration technology.

Derek Soeder is a Software Engineer and after-hours researcher at eEye Digital Security. In addition to participating in the ongoing development of eEye's Retina Network Security Scanner product, Derek has also produced a number of internal technologies and is responsible for the discovery of multiple serious security vulnerabilities. His main areas of interest include operating system internals and machine code-level manipulation.

Ryan Parmeh is a Senior Software Engineer at eEye Digital Security. He focuses mainly on the Retina and SecureIIS product lines. He has worked in the porting of nmap and libnet to Windows, as well as helping with disassembly and reverse engineering, and exploitation efforts within the eEye research team.

Yuji Ukai is a researcher and software engineer with eEye Digital Security. After completing his Ph.D. in computer science at the National University of Tokushima, he began his employment at an appliance vendor in Japan where he developed embedded operating systems. Over the last several years he has discovered several important security holes affecting various software products as well as pioneered new trends in wireless security technologies.

The IKE protocol is the key protocol in modern VPN solutions based on IPsec. It is a well known and standardized protocol. The protocol has undergone several audits and weaknesses have been found and are commonly known. Yet many more weaknesses and vulnerabilities are hidden within the IKE implementations by the different vendors.

This talk will present a new toolset written in Perl to test the different IKE implementations in a scientific and reproducable way. This toolset offers the generation and modification of each IKE-message using simple Perl commands. The examiner can inject arbitrary values, keys and algorithms in each message. Using this toolset very simple as well as complex vulnerabilities may be found. The talk will demonstrate at least the detection of the recent KAME-racoon authentication vulnerability on Linux and *BSD systems (CVE: CAN-2004-0155).

Ralf Spenneberg has used Linux since 1992 and worked as a system administrator since 1994. During this time he was responsible for numerous Windows, Linux and UNIX systems. The last 6 years he has been  working as a freelancer in the Linux/UNIX field.

Most of the time he provides Linux/UNIX training. His specialty is network administration and security (firewalling, VPNs, intrusion detection and penetration testing).

He has developed several training classes used by Red Hat and and other IT training companies in Germany.

He has spoken on several SANS conferences and even more UNIX/Linux specific conferences. He was chosen to be member of the program comittee of the Linux Kongress and the GUUG Frühjahrsfachgespräch.

The Metasploit Framework has progressed from a simple network game to a powerful tool for administrators and security analysts alike. Over the past several months, the Framework has been enhanced with improved exploit techniques and a truly advanced suite of payloads. This presentation provides a background on what exploit frameworks are, what they can provide you, and why you should be using one. A live demonstration will highlight many of the advanced features of the Framework, describe how they can be used to accomplish a variety of tasks, and show that the technology for "hacking like in the movies" is already available today. Attendees will be provided with an early-access copy of version 2.2 of the Metasploit Framework; which includes a number of techniques and exploit modules that are not publicly available anywhere else. Additionally, this release is the first version of the Framework to include a development kit for creating your own custom modules.

Spoonm is currently pursuing a Bachelors degree in Software Engineering. Much to the detriment of his early morning classes, he is an active researcher in many different security areas, most notably in the exploitation and post-explotation process. He has developed several post-exploitation tools, and between working as a security consultant, and asm wielding, he currently spends most of his time working on the Metasploit Framework.

HD Moore is one of the founding members of Digital Defense, a security firm that was created in 1999 to provide network risk assessment services. In the last four years, Digital Defense has become one of the leading security service providers for the financial industry, with over 200 clients across 43 states. Service offerings range from automated vulnerability assessments to customized security consulting and penetration testing. HD developed and maintains the assessment engine, performs application code reviews, develops exploits, and conducts vulnerability research.

Great confusion has set in over the last 18 to 24 months around the role of the firewall in the application security and intrusion prevention arena. A common reaction to the increased volume and effectiveness of high-profile attacks we hear about in the news today is, “I have a firewall, but these attacks are still getting inside my network. I thought my firewall was supposed to protect my network and applications!?”

This presentation will discuss the nature of known (already identified and understood) threats, and unknown (first-time day-zero) threats, and how various perimeter gateway (firewall) technologies deliver from strong to weak attack protections against application level attacks.   In particular, next generation application proxy technology will be compared and contrasted with Check Point's Application Intelligence and NetScreen's Deep Inspection technologies (using specific examples of how they handle a variety of attacks).

Andrew Stevens has been involved with network security at Secure Computing for over 8 years and has a background in computer networking for close to 15 years. He is frequently called upon to make presentations for enterprise customers to recommend application proxy firewall technologies and speak at many industry and security conferences. Prior to joining Secure Computing, Mr. Stevens held several computer and networking positions with education, federal and local government organizations. Mr. Stevens has a degree in Business Information Systems from Algonquin College in Ottawa, Ontario, Canada.

Host Intrusion Prevention Systems (HIPS) is the latest buzzword in the security arena. But is it just that? A buzzword?

This presentation will give a brief introduction to Host Intrusion Prevention Systems, explain how they work and show examples of how some HIPS implementations can be successfully attacked and bypassed.

Eugene Tsyrklevich is Chief Technical Officer for Security Architects, a security company based in London specializing in advanced security solutions. Eugene has an extensive security background ranging from designing and implementing Host Intrusion Prevention Systems to training people in research, corporate, and military environments. Eugene holds both a Bachelor and a Masters degree in Computer Science from the University of California, San Diego.

The United States Federal Government has recently become very active in the arena of Information Assurance (IA) procedures. One such area is the Certification and Accreditation (C & A) of Information Technology (IT). The first document used by the U.S Government for C & A was published in 1993. It was called the Department of Defense Trusted Computer System Evaluation Criteria, also known as the Orange Book. Other directives to deal with the modern threat to IT have recently superceded the Orange Book. These new processes are the Defense Information Technology Security Certification and Accreditation Process (DITSCAP) and the National Information Assurance Certification and Accreditation Process (NIACAP).  Both attempt to bring the U.S Government into the modern times of IT security because much has changed since the creation of the Orange Book.

The goal of this paper is to provide an understanding of the C & A process from what documents need to be reviewed to what steps need to be taken to obtain accreditation. This information is critical not only to workers but to every U.S. citizen as portions of the U.S. Government’s IT is of a classified nature that is critical to National Security. During the C & A process, all parties involved must agree on what needs to be done, who will accomplish the tasks and what the estimated timeline is for completion. While this may sound like an unnecessary process, a closer look reveals that each step is extremely critical to ensuring successful deployment of security into an existing IT environment. Understanding the process for Certification and Accreditation is not only a matter of national security, it is the very basis for security in any IT environment in any country.

Jeff Waldron, CISSP has over 13 years of IT experience – over 9 of those years are IT Security specific.  Has supported both Commercial, State, Federal and DoD IT security environments.  Extensive knowledge of Host and Network-Based Intrusion Detection/Prevention tools and technologies

Port-knocking has recently become a popular concept, and a common source of discussion. Many groups and communities have argued about the importance and viability of port-knocking as a security concept, or as an additional security measure. One of the main complaints about port-knocking is that one can implement trivial replay attacks against any static port-knocking system. This problem can be remedied by implementing a cryptographic system in tandem with a traditional port-knocking ideas. One of the simplest means of implementing a cryptographic port knock is by using a one-time-password system (otp or s/key). Such a system has been implemented in COK, which is trivially extensible, and flexible enough to be useful in a production environment, which will allow for port-knocking from public locations with a minimum amount of pain.

David Worth is a graduate student in pure mathematics who has been tinkering with security in general for many years. He acted as security officer for a high-performance computing center but focuses mainly on academics now. And he can drink you under the table.

Paul Wouters has been involved with Linux networking and security since he co-founded the Dutch ISP "Xtended Internet" back in 1996. His first article about network security was published in LinuxJournal in 1997 Since then, he has written mostly for the Dutch spin-off of the German "c't magazine", focussing on Linux, networking and the impact of the digital world on society. He has presented papers at SANS, OSA, CCC and HAL.

He is currently involved with the FreeS/WAN project, a Linux IPsec stack that aims to bring Opportunistic Encryption to everyone. For this feature, a secure DNS is needed, which triggered his interest in assisting the widespread use of DNSSEC. Wouters received his Bachelors degree in Education in 1993

Traditional anomaly-based Intrusion Detection Systems, relying on pattern matching and static signatures, are not really able to keep up with the creation of new forms of attacks, and particularly with zero-day attacks. In this talk we will analyze the problem, and present new types of misuse detection systems, based on unsupervised learning techniques, that can complement well traditional IDS systems and help detect zero-days techniques of attack and various other misbehaviours. A proof of concept based on our current research prototypes will be also presented.

Stefano Zanero, M.S. in Computer Engineering, has graduated “cum laude” from the Politecnico of Milano school of engineering, with a “Laurea” (M.S.) thesis on the development of an Intrusion Detection System based on unsupervised learning algorithms. He is currently a Ph.D. student in the Department of Electronics and Information of the same university. Among his current research interests, besides learning IDSs, there are performance metrics for security systems and clustering techniques. He has been a speaker at international scientific, technical and legal conferences. He is a member of the IEEE (Institute of Electrical and Electronics Engineers) and the ACM (Association for Computing Machinery). Besides co-authoring books on information security and scientific articles, he is the author of the weekly “Security Manager’s Journal” on Computer World Italy, and has been recently awarded a journalism award. Since 2004 he is a partner and CTO of Secure Network, a firm specializing in information security training and consulting, based in Milan.

Stefano recommends visiting the Secure Network website (www.securenetwork.it) for up to date security information.

In the past twelve months, the House has held two Congressional testimonies on the issue of protecting customer data. Witnesses from these hearings will present updated testimonies to a committee of security experts at the Black Hat Briefings. These updates will also include an analysis of action since the Hearings. The session will be structured like the Congressional Hearings with the addition of audience preparation and participation. The audience will have an opportunity to question and comment during the live forum. Original testimonies are available at http://energycommerce.house.gov/108/Hearings/11192003hearing1133/Ansanelli1797.htm and http://energycommerce.house.gov/108/Hearings/11192003hearing1133/Davidson1796.htm

Witnesses:
Joseph Ansanelli is CEO of Vontu, a software company focused on the insider threat. Joseph has spoken to Congress twice in the past twelve months as an advocate of privacy and consumer data standards. Mr. Ansanelli has successfully co-founded and led two other companies and has an extensive track record of developing innovative solutions into successful companies. His first venture, Trio Development's Claris Organizer, was ultimately acquired by Palm, Inc. Mr. Ansanelli holds four patents and received a B.S. in Applied Economics from the Wharton School at the University of Pennsylvania.

Mary Ann Davidson is the Chief Security Officer at Oracle Corporation, responsible for Oracle product security, corporate infrastructure security and security policies, as well as security evaluations, assessments and incident handling. She represents Oracle on the Board of Directors of the Information Technology Information Security Analysis Center (IT-ISAC) and is on the editorial review board of the Secure Business Quarterly. Ms. Davidson has a B.S.M.E. from the University of Virginia and a M.B.A. from the Wharton School of the University of Pennsylvania. She has also served as a commissioned officer in the U.S. Navy Civil Engineer Corps, during which she was awarded the Navy Achievement Medal.

Committee Members:
Michele Drgon, Senior Director of Data Protection/Privacy for Motorola, has created the Motorola Privacy Council Office which oversees all internal Privacy policy and compliance management. Additionally she is involved with driving Privacy technology and product strategies across the Motorola product sectors. Michele has recently been the Advisory Council Representative to the W3C and on the Board of Directors of the Open Group and the International Security, Trust and Privacy Alliance. She has also been a member of the Information Technology Industry (ITI) Council’s Chief Privacy Officers Working Group and was co-chair of the DRM Technical Working Group.

Mark McGovern is a senior analyst with In-Q-Tel and leads their mobility and privacy technology investment programs. Mark has more than 16 years of experience developing and deploying secure systems. He's worked with a variety Fortune 500 clients including Microsoft, MasterCard International, CitiBank, Symantec, CheckFree, the UK National Lottery and the Federal Reserve Banks of Richmond, New York and Boston. Mark began his career as an engineer with the Central Intelligence Agency. As an agency engineer he developed a wide variety of systems to support intelligence activities. In addition to these experiences, Mark has assisted the American Red Cross in designing computer and communications systems to support disaster service efforts. He's adapted submarine technologies for use in "Star Wars" missile defense systems, designed and built equipment for use on NASA's space shuttle, and developed software models to predict intercontinental ballistic missile trajectories. Mark holds a B.S. in Electrical Engineering from Worcester Polytechnic Institute and an M.S. in Systems Engineering from Virginia Polytechnic Institute.

Adam Shostack is a privacy and security consultant and startup veteran. Adam worked at Zero-Knowledge building and running the Evil Genius group of advanced technology experts, building prototypes and doing research into future privacy technologies, including privacy enhancing networks, credentials, and electronic cash. He has published papers on the security, privacy, as well as economics, copyright and trust. Shostack sits on the Advisory Board of the Common Vulnerabilities and Exposures initiative, the Technical Advisory Board of Counterpane Internet Security, Inc and others. Adam is now a independant consultant.

Expertise in computer forensic technology means nothing if that expertise can’t be conveyed convincingly to a jury. Presenting technical evidence in a courtroom is a far cry from presenting a technical paper at Black Hat. Sure, a computer professional may understand the importance of full headers in tracing email origins, but a jury has no clue. The real challenge in the field of computer forensics is translating complicated technical evidence in terms your typical grandmother would understand.

This presentation will enact a courtroom environment, complete with judge, attorneys, and witnesses to demonstrate key issues in computer crime cases. While we strive to make case arguments and legal issues as accurate as possible, some liberties are taken to streamline the presentation and keep it entertaining.

Trial Presentation:
Chief Judge Philip M. Pro – Chief United States District Court Judge for the District of Nevada
Richard Salgado, Senior Counsel, Computer Crime and Intellectual Property Section of the United States Department of Justice
Erin Kenneally M.F.S., J.D Forensic Analyst, San Diego Supercomputer Center
Simple Nomad, BindView: Occam Theorist, NMRC: Hacker
Jesse Kornblum, Captain, USAF, United States Naval Academy
Jack Holleran, Former NSA
Brian Martin, Security Consultant
Richard Thieme, CEO, Thiemeworks, Inc
Jonathan Klein, Senior Manager, Security, Calence, Inc
Ken Olthoff , Emcee
Caitlin Klein, Court Clerk

Carole Fennelly (producer and contact) (fennelly at wkeys.com)
Carole Fennelly is an author, speaker and information security consultant. She was co-founder of the Wizard's Keys security consulting firm which has been providing security expertise to Fortune 500 clients in the New York Metropolitan area for more than ten years. Ms. Fennelly has also published numerous articles for IT World, Sunworld and Information Security Magazine. She has been a speaker at Blackhat and many other security conferences. Her technical background includes an in-depth security and administration knowledge of UNIX operating systems.

Honorable Philip M. Pro, Chief United States District Court Judge for the District of Nevada
Judge Pro was appointed United States District Court Judge for the District of Nevada, at Las Vegas, on July 23, 1987.

Judge Pro also served as United States Magistrate Judge for the District of Nevada from 1980 until his elevation to the District Court, during which he supervised pretrial proceedings in the MGM Grand Hotel Fire Litigation. Judge Pro received his J.D. degree from Golden Gate University School of Law in June 1972

Erin Kenneally, M.F.S., J.D.
Ms. Kenneally is a licensed Attorney who holds Juris Doctorate and Master of Forensic Sciences degrees. She consults, researches, publishes, and speaks on prevailing and forthcoming issues at the crossroads of information technology and the law. This includes evidentiary, procedural, and policy implications related to digital forensics and information security. She has lectured and

helped coordinate training conferences for officers of the court, law enforcement, and industry professionals concerned with digital evidence and information forensics. She is a Forensic Analyst at the San Diego Supercomputer Center, liaises and holds leadership positions with the Computer and Technology Computer High Tech Task Force (CATCH) and High Technology Computer Investigation Association (HTCIA) and provides thought leadership to numerous private and government advisory committees engaged in information technology law issues.

Paul Ohm (Paul dot ohm at doj.gov)
Paul Ohm used to write code for a living. Then he went to law school, and he's never really been the same. He now works for the U.S. Department of Justice.

Raven Alder
Raven Alder is a Senior Security Engineer with True North Solutions. She has spoken about security, cryptography, and network engineering at a variety of conferences, including Linux World Expo, AusCERT, and DefCon. In addition to doing consulting for enterprise networks, she has contributed to a book on Snort, and currently spends too much of her time peering at Packets That Should Not Be, and writing about them.

Richard Thieme (rthieme at thiemeworks.com)
Richard Thieme is a business consultant, writer, and professional speaker focused on "life on the edge," in particular the human dimension of technology and work. He is a contributing editor for Information Security Magazine. Speaking/consulting clients include: GE Medical Systems; Los Alamos National Laboratory; Apache Con; Microsoft; Network Flight Recorder; System Planning Corporation (SPC); InfraGard; Firstar Bank; Financial Services - Information Sharing and Analysis Center (FS-ISAC); Psynapse/Center for the Advancement of Intelligent Systems; Cypress Systems; Assn. for Investment Management and Research (AIMR); Alliant Energy; Wisconsin Electric; UOP; Ajilon; OmniTech; Strong Capital Management; MAPICS; Influent Technology Group; FBI; US Department of the Treasury; the Attorney General of the State of Wisconsin; and the Technology, Literacy and Culture Distinguished Speakers Series of the University of  Texas.

Jonathan Klein (Jklein at calence.com)
Jonathan Klein is a senior security manager with Calence Inc, a networking company located in Tempe Arizona. Jon has been a software developer in the Unix/C environment for over 20 years. During that time, he has developed custom security software for several large financial institutions and held key roles in numerous application deployments. Facing the choice of a management career that would remove him from hands-on technical work, Jon chose consulting as a method of achieving both. Jon has participated in forensic investigations on behalf of the Federal Defender's Office in Manhattan and with private attorneys, discovering there is more to being a technical witness than purely technical knowledge. Most recently, he served as defense expert witness in U.S. vs. Oleg Zezev, the Russian citizen accused of hacking into Bloomberg LLP and making extortion demands.

Brian Martin (Jericho at attrition.org)
Brian Martin is an outspoken security consultant in the Denver, Colorado area. Brian has the relatively unique experience of being on both sides of an FBI investigation. His daily work takes him in and out of commercial and government networks, usually without sparking law enforcement investigation. His work revolves around making recommendations based on cynical review of network and system security. He will be survived by his three cats.

Jesse Kornblum
Captain Jesse Kornblum is an instructor in the Computer Science Department at the United States Naval Academy. Before this assignment, he was an agent with the Air Force Office of Special Investigations, and served as Chief of Research and Development for that agency. A graduate of the Massachusetts Institute of Technology, his research is focused on computer forensics and computer security. Contact: research [at] jessekornblum [dot] com. http://research.jessekornblum.com/

Jack Holleran (Jholleran at Comcast.net)
Jack Holleran, CISSP, currently teaches Information Security at several colleges and the Common Body of Knowledge review for ISC2. In a past life, he was the Technical Director of the National Computer Security Center at the National Security Agency and Chair of the National Information Systems Security Conference.

Richard P. Salgado (Richard dot salgado at usdoj.gov)
Richard Salgado serves as Senior Counsel in the Computer Crime and Intellectual Property Section of the United States Department of Justice. Mr. Salgado specializes in investigating and prosecuting computer network cases, such as computer hacking, denial of service attacks, illegal sniffing, logic bombs, viruses and other technology-driven privacy crimes. Often such crimes cross international jurisdictions; Mr. Salgado helps coordinate and manage the investigation and prosecution of those cases. Mr. Salgado participates in policy development relating to emerging technologies such as the growth of wireless networks, voice-over Internet Protocol, surveillance tools and forensic techniques. Mr. Salgado serves as a lead negotiator on behalf of the Department in discussions with communications service providers to ensure that the ability of the Department to enforce the laws and protect national security is not hindered by foreign ownership of the providers or foreign located facilities. Mr. Salgado also regularly trains investigators and prosecutors on the legal and policy implications of emerging technologies, and related criminal conduct. Mr. Salgado is an adjunct law professor at Georgetown University Law Center where he teaches a Computer Crime seminar, and is a faculty member of the SANS Institute. Mr. Salgado graduated magna cum laude from the University of New Mexico and in 1989 received his J.D. from Yale Law School.

Weasel (Weasel at nmrc.org)
Weasel is a freelance security consultant specializing in Intrusion Detection, Policy, Incident Response, Digital Forensics, Penetration Testing, and Security Awareness. He is also a charter member of an industry Information & Sharing Analysis Center and is a member of Nomad Mobile Research Centre.

Ryan Bulat (Shadow at wkeys.com)
Ryan Bulat is an intern at Wizard’s Keys, where he is responsible for web site support. His interests  are in Science and Technology as well as programming. When school doesn’t intrude, he is also an avid gamer who wonders why game stats aren’t included in college admissions along with SAT scores.

Jennifer Granick (Jennifer at granick.com)
Jennifer Stisa Granick is the Litigation Director of the public interest law and technology clinic at Stanford Law School's Center for Internet and Society. Ms. Granick's work focuses on the interaction of free speech, privacy, computer security, law and technology. She is on the Board of Directors for the Honeynet Project and has spoken at the NSA, to law enforcement and to computer security professionals from the public and private sectors in the United States and abroad. Before coming to Stanford Law School, Ms. Granick practiced criminal defense of unauthorized access and email interception cases nationally. She has published articles on wiretap laws, workplace privacy and trademark law.

Rebecca Bace (Infomom at sprintmail.com)
Rebecca Bace is the President/CEO of Infidel, Inc., a network security consulting practice, headquartered in Scotts Valley, CA. She is also a Venture Partner for Trident Capital, a venture capital firm in Palo Alto. Bace provides strategic and operational consulting services for clients that include security point product developers, legal firms, and Internet solutions providers, and also directs investments in security startups. She is a noted author on topics in intrusion detection, network security, and forensic testimony with credits including the white paper series for ICSA's Intrusion Detection Consortium, a book on "Intrusion Detection" (published by Macmillan in 2000) and a book on "Forensic Testimony" (with Fred Smith), published by Addison Wesley in October, 2002.

The issue of security testing between banks and corporate networks is one of the most important and delicate concerns facing consumers and businesses today. It is where fraud takes place, financial information is leaked, and often the lowest common denominator targeted by attackers. To solve the problem takes cooperation. Until the reality of this situation is communicated and the problem engaged, both the consumer and business sectors remain at risk of personal information theft and loss of revenue.

The solution to this concern lies in a cooperative understanding of the threat by all partners, and a top-down, coordinated effort to secure interdependencies. JD Glaser, renowned security freeware author, will present a new free tool and research concerning virtual fraud and the crucial interconnection issues companies have with their partners and financial institutions. After JD's presentation, he will lead a panel discussion with executives confronting this issue.

To be released at Black Hat, ntoinsight is a free command line web crawler capable of scanning even the largest websites: analyzing site content, architecture and external interdependencies. ntoinsight crawls all site links/resources and catalogues them with their resources attributes (i.e. filetype, forms, mail ids, applets/objects, hidden fields, cookies, authentication, SQL connections and more). ntoinsight generates XML and HTML reports that graphically communicate all findings, including web server platforms, response codes, resources details and site interdependencies (links leaving the domain, passing information, etc.). Furthermore, ntoinsight identifies “Attack Points†targeted by hackers, thus communicating the extent of site threat exposure.

Jassen "JD" Glaser is President and CEO of NT OBJECTives, a company he founded originally in 1997 to deliver the first Windows NT based security tools to the information security community. Widely heralded as one of the top industry luminaries, JD continues to develop a legacy of excellence in building the industry's top security technologies and services to this day. JD brings over a decade of experience in security assessment and application development.

Previously, JD worked as the Director of Engineering at Foundstone, a leader in information security services and technology. In his position, JD was the primary architect for FoundScan. Prior to Foundstone, JD founded NT OBJECTives and developed some of the most widely used security tools in the industry, with over 100,000 subscribers at its peak. JD also wrote the first Windows NT compatible version of Tripwire, a benchmark technology for data integrity. JD has previously worked with companies such as Intel, Hewlett Packard and Columbia Sportswear in architecting and building enterprise network database systems.

JD has been a regular instructor at the Black Hat conferences, and is a speaker at top industry conferences and trade shows. He has provided instructional courses on security tactics and techniques to numerous Global 100 companies and the government.

David Mortman, Director of Global Security for Siebel Systems, Inc., and his team are responsible for Siebel Systems' worldwide IT security infrastructure, both internal and external. He also works closely with Siebel's product groups and the company's physical security team. Previously, Mortman was Manager of IT Security at Network Associates, where, in addition to managing data security, he deployed and tested all of NAI's security products before they were released to customers. Before that, Mortman was a Security Engineer for Swiss Bank. A CISSP, member of USENIX/SAGE, and speaker at RSA's 2002 security conference, Mortman earned a BS in Chemistry from the University of Chicago.

Paul Simmonds joined ICI in 2001 when he was recruited to head up Information Security for ICI (www.ici.com), working for the CIO Office in London. Prior to joining ICI he spent a short time with a high security European web hosting company as Head of Information Security, and before that seven years with Motorola, again in a global information security role. Paul is also a founding member of the Jericho Forum, a pan-global grouping of corporate companies working to define the issues and benefits of operating in a de-perimeterised environment.

In his career he has worked with many external agencies, including the FBI, Scotland Yard, Wiltshire Computer Crime and Wiltshire Child protection. He has also been directly involved in two successful criminal prosecutions, giving evidence in one case.

Paul has a degree in Electronic Engineering and a City & Guilds in Radio Communication and is also a qualified kayak coach. He came to the Information Security field from a background in IT Systems Implementation and consultancy during which he wrote and implemented one of the UK's first web sites.

He is married with three children and a very understanding wife and in the little spare time that he has teaches canoeing and runs charity radio stations.

Justin Somaini is Director of Information Security at VeriSign Inc. where he is responsible for managing all aspects of network and information security for VeriSign. With over 10 years of Information Security and Corporate Audit experience, Justin has leveraged his knowledge of audit and large organizations to remediate global infrastructure problems and create a full risk identification and remediation Information Security group. Previously, Justin was the Director of Information Security Services for Charles Schwab Inc., where he was responsible for all aspects of Information Security Operations. Before that he was a Manager with PricewaterhouseCoopers LLP where he spent several years developing their attack and penetration leadership and audit practice.

As a result of insecure custom application code and unpatched web servers, web application security vulnerabilities are one of the most prolific attack vectors for hacking into organizations. The threat is very real and the risk lies not only in known vulnerabilities, but those vulnerabilities yet to be discovered. For web application attacks, you not only need to concern yourself with the well-known issues, but the unknown as well. For eBusiness web sites, these previously unknown vulnerabilities are found in over 90% of the web sites tested. Web application security is fairly new and the best practices for combating these threats are just starting to emerge.

With different viewpoints from the participating panelists, the discussion will focus on the many approaches to web application security. Each panelist possesses a different background— corporate security, security consulting, security product, and security research— with interesting perspective on how to effectively protect a web site and web-based applications. The panelists will share their day-to-day, in-the-trenches experiences and will answer questions from the audience.

Panel Topics:

• The "Real" Top Security Vulnerabilities
• What are companies doing and what aren't they doing to protect their critical assets from web application attack. Are the solutions working?
• Do application scanners, firewalls and codewalkers really work?
• Is offshore application development affecting the security landscape.

Moderator:
David Rhoades is a principal consultant with Maven Security Consulting Inc. Maven Security Consulting Inc. is headquartered outside Washington DC and provides information security assessments and training.

David's expertise includes web application security, network security architectures, and vulnerability assessments for networks and telecommunication systems. Past customers have included domestic and international companies in various industries, as well as various US government agencies. David has been active in information security consulting since 1996, when he began his career with the computer security and telephony fraud group at Bell Communications Research (Bellcore).

David was the concept creator for Achilles, the first publicly released general purpose web application security assessment tool

David teaches domestically and internationally at various security conferences, and has taught for the SANS Institute, the MIS Training Institute, ISACA, USENIX, and ISACA.

David has a bachelor's degree in computer engineering from the Pennsylvania
State University.

Jeremiah Grossman, Founder and Chief Executive Officer, WhiteHat Security
Jeremiah Grossman is the founder and CEO of WhiteHat Security, Inc. Prior to WhiteHat, Mr. Grossman was a former information security officer for Yahoo!, where he was responsible for performing security reviews on the company's hundreds of web applications.

A 6-year security industry veteran, Mr. Grossman’s research has been featured in USA Today, NBC, and ZDNet while exploring all areas of web security. He is a world-renowned leader in web security and frequent speaker at the Blackhat Briefings, NASA, Air Force and Technology Conference, Washington Software Alliance, ISSA, and Defcon.

Jeremiah Grossman is a founder of the Web Application Security Consortium (WASC), co-founder of the Open Web Application Security Project (OWASP), as and contributing member of the Center for Internet Security Apache Benchmark Group.

Paul E. Proctor, CISSP, CISM, Vice President, Security & Risk Strategies, META Group, Inc
Mr. Proctor has been involved in information security since 1985. He was founder and CTO of two security technology companies and developed both first- and second-generation host-based intrusion detection technologies. Mr. Proctor is a recognized expert in the field of information security and associated regulatory compliance issues surrounding the Health
Insurance Portability and Accountability Act (HIPAA), Sarbanes-Oxley, and the Gramm-Leach-Bliley Act (GLBA). He has authored two Prentice Hall books and many white papers and articles. Mr. Proctor is an accomplished public speaker and was recognized for his expertise by being appointed to the original Telecommunications Infrastructure Protection working group used by Congress to understand critical infrastructure protection issues prior to 9/11. Previously, he worked for SAIC, Centrax, CyberSafe, Network Flight Recorder, and Practical Security. Mr. Proctor holds a BS in Mathematics/Computer Science from the University of Illinois.

Frank Lam, CISSP, Senior Manager, Deloitte & Touche LLP
Frank Lam is a senior manager in the Deloitte & Touche's Enterprise Risk Services practice, delivering enterprise-wide risk and security consulting services. He has over eight years' experience in the field of information systems and security management and systems design and integration. Frank is responsible for the overall delivery and quality assurance of network, system, and application security engagements. He has performed consulting services in the areas of system and network penetrations as well as implementation dealing with databases, firewalls, IDS, encryption, and remote access solutions. For the past 4 years, Frank has focused and led numerous application-based assessments and penetration tests. He has contributed to articles and researches in media, such as Security Management Magazines and MSNBC, and is a member of CISSP and CISM.

Caleb Sima, CTO & Co-Founder SPI Dynamics
In early 2000, Caleb Sima co-founded SPI Dynamics, the expert in application security assessment, where he currently holds dual roles of CTO and director of SPI Labs, the highly regarded application R&D security team within SPI Dynamics. Prior to co-founding SPI Dynamics, Caleb worked for Internet Security Systems (ISS), an industry pioneer and global leader in Internet security. Caleb was a member of ISS’ elite X-Force team, led the creation of the first penetration testing team and drove enterprise security assessments for the company. Caleb began his career in 1996 as a security engineer for S1 Corporation, where he was responsible for testing the security of software products for the banking and finance industries. Caleb's engineering exploits have gained media attention in publications such as the New York Times and the Washington Post. He has also contributed to Baseline Magazine and SC Magazine and was featured, along with the ISS X-Force, in US News and World Report and Security World Magazine. A frequent speaker at industry events and tradeshows, including the 2002 Cyber Security in the Financial Services Sector Executive Summit, the 2003 SouthEast CyberCrime Summit, Comdex 2003, Information Systems Security Association (ISSA) and RSA 2004. Caleb is a member of ISSA and is one of the founding visionaries of the Application Vulnerability Description Language (AVDL) standard within OASIS.